GNU Emacs CVE-2026-77219

Exploitation requires the target to open a specially crafted PBM, PPM, or PGM image file in a vulnerable GNU Emacs instance (any version before 31.0.91). User interaction is mandatory per the CVSS 4.0 vector (UI:P) - the victim must actively open or preview the malicious file within Emacs. No authentication, elevated privileges, or special Emacs configuration is required; the vulnerable pbm_load code path is reachable by any Emacs user who opens one of the three affected image formats. Exploitation is limited by the local attack vector (AV:L): the attacker cannot trigger this remotely without first delivering the malicious file and inducing the user to open it. The over-read is bounded by process heap layout and ASLR, so the specific heap contents exposed will vary by environment and session state.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VA:H) places this at a score of 6.9, reflecting local attack vector with user interaction required but no privilege prerequisite. The high confidentiality impact (VC:H) is well-supported: heap over-read contents rendered visually could expose sensitive in-process data such as authentication tokens, editor buffers, or process memory from other operations. The high availability impact (VA:H) is plausible - reading past the heap buffer boundary can trigger a segmentation fault or crash the Emacs process. The local attack vector (AV:L) and mandatory user interaction (UI:P) are the primary risk-limiting factors; this is not remotely exploitable unless an attacker can deliver a file and convince the user to open it. No KEV listing means no confirmed active exploitation. No public POC has been identified. EPSS data is not provided; given the constrained vector, exploitation probability is expected to be low. There is no conflict between the CVSS signals and the description: the local vector is consistent with a file-format parsing vulnerability in a desktop application.

An attacker crafts a PBM, PPM, or PGM image with extreme dimension values (e.g., width and height set near INT_MAX/3 to cause signed overflow after channel multiplication) and delivers it to a target via email attachment, shared filesystem, or download link. When the Emacs user opens the file - including inadvertently via file-manager preview or M-x find-file - the integer overflow bypasses the buffer bounds check, and the pixel reader fetches heap data beyond the allocated image buffer, rendering it on-screen as pixel colors. A motivated attacker could recover heap contents by capturing a screenshot or observing the rendered image, potentially extracting sensitive in-memory data.